walletlive-auth-dshfkjsd84[.]shalee314[.]workers[.]dev

This domain, walletlive-auth-dshfkjsd84.shalee314.workers.dev, is identified as a crypto drainer, a threat designed to illicitly transfer cryptocurrency assets from victims' wallets. Analysis indicates the domain impersonates legitimate cryptocurrency wallet services, likely targeting users through deceptive authentication prompts or wallet connection requests. No specific drainer kit has been conclusively attributed to this instance, though the infrastructure aligns with known crypto-focused phishing campaigns. Infrastructure analysis reveals the domain resolves to the IP address 172.67.195.213, hosted under AS13335, and was registered through Cloudflare, Inc. The domain creation date is February 8, 2019, though the malicious activity appears to be more recent. Detection metrics show 19 out of 95 security vendors flagged the domain on VirusTotal, while it appears on one additional security blocklist. The SSL certificate is issued by Google Trust Services, and the domain was not listed on Google Safe Browsing at the time of analysis. The domain is currently offline, likely due to takedown actions or abandonment by the threat actor. Despite its inactive status, residual risk remains for users who may have interacted with the domain during its operational phase. Organizations and individuals are advised to monitor wallet transactions for unauthorized activity and implement additional verification steps for cryptocurrency-related interactions. Blocking the domain and associated IP addresses at the network level is recommended to prevent potential re-emergence.